Skip to content

Security reporting

Report a suspected security vulnerability.

Start with a non-sensitive summary of the issue you observed in Rellooma. Do not send customer data or credentials.

01

Scope and operating boundary

The owner contact is mani@rellooma.com. Ask for an agreed secure channel before sharing sensitive technical evidence.

02

Current limitation

This draft does not authorize testing, offer a bounty or promise a response deadline. Mailbox delivery and the handling process still require owner verification.

03

Decision this page supports

A clear report can help identify the affected service without exposing another person's data.

How to report safely

Draft 0.1 · Reviewed 6 October 2026 · Not an effective testing policy

English is the draft source. Turkish and Persian versions are informational translations pending review.

Start a non-sensitive security report: mani@rellooma.com

What to include

Identify the affected Rellooma URL or feature, the time observed, expected and actual behavior, and minimal steps to explain the issue. Redact identifiers and use synthetic examples. Do not attach passwords, tokens, private messages or customer records.

Protect people and services

Stop if you encounter someone else's data. Do not access additional records, alter data, interrupt services, run denial-of-service tests, phish users or target third-party providers. This page gives no permission to test any system; obtain explicit authorization first.

Sensitive evidence

Ordinary email is not a verified secure evidence channel here. Send only a non-sensitive initial summary to the owner contact, then agree a secure transfer method before sharing restricted technical details. Do not post exploitable details publicly while coordination is pending.

Handling and limits

The mailbox and triage process await owner verification. No acknowledgement deadline, remediation deadline, payment, safe-harbor protection or legal immunity is promised. A report is not proof of receipt or resolution. Account support and data-rights requests use their separate routes.